LegionLoader

Initial access The malware is delivered by “drive by download” technique.

The threat actor sent emails disguised as instructions for issuing accounts for internal business systems and lured users into clicking a malicious URL.

The PowerShell command executed via ClickFix downloads additional PowerShell code from an external server and runs it in the background.

The command used for extraction is as follows: "C:\Users\???\AppData\Roaming\Viqwo Stars Ci\Rotq App\UnRar.exe" x -p3809610121t -o+ ...

The sample requires user interaction to execute, triggered by the execution of the setup.msi file.

When a user clicks on the malicious URL in the email, they are redirected multiple times and ultimately connected to a malicious page disguised as a Cloudflare CAPTCHA screen.

The archive contains several legitimate DLLs and a malicious Setup.exe file that the user needs to execute manually to initiate the infection chain.

The fake Cloudflare CAPTCHA page instructs the user to perform separate Windows command execution; if the user follows the instructions and executes the PowerShell command copied to the clipboard, additional code is downloaded and run.

The main purpose of the malware that is dropped by the Satacom downloader is to steal BTC from the victim’s account by performing web injections into targeted cryptocurrency websites. The malware attempts to do this by installing an extension for Chromium-based web browsers.

Persistence setup: Registering 'Run' and 'RunOnce'.

Finally, the PS script recursively searches for any link (.LNK) file in the above locations and modifies the “Target” parameter for all existing browser shortcuts with the flag “–load-extension=[pathOfExtension]” so that the shortcut will load the browser with the malicious extension installed.

The backdoor can execute native PE files using process injection and execute shellcode through Explorer.exe process injection.

Native PE execution includes 'RuntimeBroker.exe' process hollowing.

Persistence setup: Registering 'Run' and 'RunOnce'.

Finally, the PS script recursively searches for any link (.LNK) file in the above locations and modifies the “Target” parameter for all existing browser shortcuts with the flag “–load-extension=[pathOfExtension]” so that the shortcut will load the browser with the malicious extension installed.

LegionLoader sequentially decrypts encrypted shellcode and PE files it contains, then executes the final backdoor malware.

The malicious page is disguised as a Cloudflare CAPTCHA, while malicious URLs are presented as an official website or legitimate internal business system.

The backdoor can execute native PE files using process injection and execute shellcode through Explorer.exe process injection.

Native PE execution includes 'RuntimeBroker.exe' process hollowing.

This buffer is then decoded, revealing the shellcode... Another buffer in then created and data is copied to it using the rep movsb instruction. This buffer is then decoded, revealing the stage 2 executable.

The backdoor executes MSI files using ShellExecute and msiexec.

Since the malware later attempts to execute the payload using rundll32, it is highly likely that the final payload is a DLL...

Within the MSI, two anti-sandbox mechanisms have been identified. The first anti-sandbox measure presents a button with the label “Please verify that you are not a robot.”. In one of the samples, it was observed that a virtual environment is detected through a feature of Advanced Installer.

The restored shellcode checks whether the current system corresponds to a virtualized environment, a remote environment, or an IP environment assigned by a hosting provider.

For example, it has the ability to retrieve the victims’ addresses, obtain account information, bypass 2FA, and much more.

For example, it can extract information through the browser, such as the system information, cookies, browser history, screenshots of opened tabs, and even receive commands from the C2 server.

Appendix II – MITRE ATT&CK Mapping This table contains all the TTPs identified during analysis of the activity described in this report.

The backdoor malware has the capability to steal the Chrome browser's master key and app-bound encryption keys.

An HTTP GET request is sent to ipinfo[.]io/what-is-my-ip to compare the system's ASN type value with the 'hosting' string.

For example, it has the ability to retrieve the victims’ addresses, obtain account information, bypass 2FA, and much more.

Chrome information collection includes collecting browser history.

Within the MSI, two anti-sandbox mechanisms have been identified. The first anti-sandbox measure presents a button with the label “Please verify that you are not a robot.”. In one of the samples, it was observed that a virtual environment is detected through a feature of Advanced Installer.

The restored shellcode checks whether the current system corresponds to a virtualized environment, a remote environment, or an IP environment assigned by a hosting provider.

After that, the script searches for the possible locations of shortcuts for each of the targeted browsers in such places as Desktop, Quick Launch and Start Menu.

Appendix II – MITRE ATT&CK Mapping This table contains all the TTPs identified during analysis of the activity described in this report.

JavaScripts: requesting commands from the C2 (left pane) and taking screenshots (right pane)

The malicious extension has various JS scripts to perform browser manipulations while the user is browsing the targeted websites, including enumeration and manipulation with cryptocurrency websites.

The extension performs various actions on the account in order to remotely control it using the web inject scripts, and eventually the extension tries to withdraw the BTC currency to the threat actors’ wallet.

This archive contains 2 files: A 7zip password protected archive, the sole purpose of this protection is to bypass malware analysis; and a picture file reminding the password of the next archive to the victim.

The final backdoor registers infected-host information with C2 and receives commands through nfront.php, while nback.php reports command-execution results.

To do so, it performs a DNS request to don-dns[.]com through Google DNS (8.8.8.8, another decrypted string) and it queries for the TXT record.

The executed PowerShell command downloads additional PowerShell code from an external server; this then downloads a 7z compressed file containing LegionLoader.

The reason for using the last cryptocurrency transaction of a specific wallet to retrieve the C2 address is that the server address can be changed by the threat actors at any time.

C2 communication using RC4 and Base64.

For example, it can extract information through the browser, such as the system information, cookies, browser history, screenshots of opened tabs, and even receive commands from the C2 server.

The backdoor can execute follow-up payloads by executing PowerShell after bypassing AMSI.